SAP-C02 Design for New Solutions Practice Test 14 — 15 Questions

Question 1

A company is designing a data lake on AWS using Amazon S3. The data lake will store sensitive customer data that must be encrypted at rest. The company requires that the encryption keys be managed by the company's own hardware security module (HSM) and rotated every 90 days. Which solution meets these requirements?

Accepted Answer

Use client-side encryption with keys stored in AWS CloudHSM and rotate the keys using CloudHSM key rotation. AWS CloudHSM provides dedicated HSMs that you manage, allowing you to create and manage your own encryption keys with automatic rotation. Option A (SSE-S3) uses S3-managed keys. Option B (SSE-KMS with customer managed key) uses AWS KMS, not your own HSM. Option D (SSE-C) requires you to provide the key with each request, which is not suitable for automatic rotation.

Answer

Use SSE-S3 (Amazon S3 managed keys) and configure a lifecycle policy to re-encrypt objects every 90 days

Answer

Use SSE-KMS with a customer managed key and configure automatic key rotation every 90 days

Answer

Use SSE-C (customer-provided keys) and provide the key with each PUT request, rotating the key every 90 days

Question 2

A company is designing a serverless application that processes images uploaded to an S3 bucket. The processing must be asynchronous and can take up to 15 minutes per image. Which AWS service should be used to trigger the processing?

Accepted Answer

Configure S3 Event Notifications to send an event to an Amazon SQS queue, which is polled by an AWS Lambda function. S3 Event Notifications can trigger an SQS queue, which then invokes a Lambda function asynchronously. Option A (Lambda synchronous invocation) would block and time out. Option B (SNS) is for pub/sub messaging but not ideal for long-running tasks. Option D (Step Functions) can orchestrate but is not the direct trigger for S3 events.

Answer

Configure S3 Event Notifications to publish a message to an Amazon SNS topic, which triggers an AWS Lambda function

Answer

Configure S3 Event Notifications to invoke an AWS Lambda function synchronously

Answer

Use Amazon EventBridge to capture S3 events and trigger an AWS Step Functions workflow

Question 3

A company is deploying a web application on AWS. The application requires a relational database with read replicas for scaling read queries. The database must support automatic failover and be Multi-AZ. Which database solution meets these requirements?

Accepted Answer

Amazon Aurora with Multi-AZ and Aurora Replicas. Amazon RDS for MySQL with Multi-AZ and Read Replicas provides both high availability (Multi-AZ failover) and read scaling (Read Replicas). Option A (Aurora) is also relational but is a different service. Option C (DynamoDB) is NoSQL. Option D (ElastiCache) is in-memory cache.

Answer

Amazon DynamoDB with global tables

Answer

Amazon ElastiCache for Redis with replication groups

Question 4

A company wants to provide temporary, limited-privilege credentials to its application running on an EC2 instance so that the application can access an S3 bucket. What is the BEST practice for achieving this?

Accepted Answer

Create an IAM role with the necessary permissions and attach it to the EC2 instance. Using an IAM role attached to the EC2 instance allows temporary credentials via instance metadata. Option A (access key in code) is insecure. Option B (IAM user credentials) is not temporary and less secure. Option D (S3 bucket policy) does not provide credentials to the instance.

Answer

Use an S3 bucket policy to allow access from the EC2 instance's public IP

Answer

Create an IAM user and store the credentials in the EC2 instance user data

Answer

Store AWS access keys in the application code

Question 5

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which approach provides the BEST security and performance?

Accepted Answer

Use AWS App Mesh for service-to-service communication with mutual TLS. AWS App Mesh provides service mesh capabilities for secure communication with mTLS, observability, and traffic control. Option A (internet-facing ALB) exposes services to the internet. Option B (NLB) also exposes services. Option D (VPC peering) is for connecting VPCs, not microservices.

Answer

Use VPC peering between the services' VPCs

Answer

Use an internet-facing Application Load Balancer for each service

Answer

Use an internal Network Load Balancer for each service

Question 6

A company is designing a disaster recovery (DR) strategy for a critical application. The application runs on EC2 instances in a single AWS Region. The company needs a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which TWO strategies meet these requirements? (Choose TWO.)

Accepted Answer

Use Amazon Aurora Global Database for the database and deploy EC2 instances with an Application Load Balancer that has cross-Region load balancing enabled. Multi-Region replication with Aurora Global Database provides fast failover and RPO of seconds. Application Load Balancer with cross-Region load balancing can route traffic to a warm standby in another Region. Option B (snapshot to S3) may take longer than 15 minutes RPO. Option D (single Region) does not provide DR. Option E (S3 Cross-Region Replication) is for S3 objects, not EC2 instance state.

Answer

Use S3 Cross-Region Replication for application data and launch EC2 instances from AMIs copied to the secondary Region

Answer

Take hourly snapshots of EBS volumes and copy them to another Region; use AWS CloudFormation to launch instances from the snapshots

Answer

Configure an Active-Passive failover using Route 53 with health checks within the same Region

Question 7

A company is designing a serverless data processing pipeline using AWS Lambda. The pipeline processes data from an Amazon Kinesis Data Stream. The Lambda function has a memory limit of 512 MB and a timeout of 5 minutes. The data volume is expected to increase significantly. Which TWO strategies should the company implement to improve throughput and reduce processing latency? (Choose TWO.)

Accepted Answer

Increase the number of shards in the Kinesis data stream. Increasing the number of shards increases parallelism. Using a larger batch size reduces the number of Lambda invocations. Option A (increase memory) may improve performance but each invocation still processes one batch. Option C (concurrent executions limit increase) is not needed if the account limit is not hit. Option D (change to SQS) changes the architecture.

Answer

Change the data source from Kinesis to an Amazon SQS queue

Answer

Increase the Lambda function's reserved concurrency to a higher value

Question 8

A company is designing a new cloud-native application on AWS. The application will use a microservices architecture and requires a way to manage configuration data and secrets. Which THREE AWS services can be used to meet these requirements? (Choose THREE.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager stores secrets with automatic rotation. AWS Systems Manager Parameter Store stores configuration data and secrets. AWS AppConfig manages application configuration. Option C (DynamoDB) is a database, not a configuration store. Option E (S3) can store config files but is not as integrated for secrets.

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 9

A company is designing a real-time analytics platform that ingests data from thousands of IoT devices. The platform must process and store high-velocity data with low latency. Which TWO AWS services should be used together to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams ingests high-velocity streaming data. Amazon Kinesis Data Analytics performs real-time analytics on the stream. Option B (Lambda) can be used but not as the primary analytics engine. Option C (S3) is for storage, not real-time. Option D (DynamoDB) is for low-latency queries but not for stream analytics. Option E (SQS) is for message queuing, not real-time analytics.

Answer

AWS Lambda

Answer

Amazon S3

Answer

Amazon SQS

Question 10

A company is deploying a containerized application on Amazon EKS. The application requires persistent storage that can be shared across multiple pods in different Availability Zones. Which TWO storage solutions meet this requirement? (Choose TWO.)

Accepted Answer

Amazon FSx for Lustre. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple Amazon EKS pods across different Availability Zones, making it suitable for shared persistent storage. Amazon FSx for Lustre is a high-performance file system optimized for workloads like machine learning and HPC, and it supports concurrent access from multiple clients across AZs, meeting the requirement for shared storage.

Answer

Amazon EBS with io2 volumes

Answer

Amazon S3

Answer

Amazon EC2 Instance Store

Question 11

A company is designing a new microservices architecture on AWS. Each service needs to store and retrieve small amounts of configuration data (under 10 KB per item) with low latency. The data is accessed frequently and must be highly available across multiple Availability Zones. Which AWS service should be used?

Accepted Answer

Amazon DynamoDB. Option C is correct because DynamoDB provides single-digit millisecond latency, high availability, and is ideal for storing small configuration items. Option A (S3) has higher latency for small objects and is not optimized for frequent updates. Option B (ElastiCache) is for temporary caching, not durable storage. Option D (RDS) is overkill for simple config data.

Answer

Amazon S3

Answer

Amazon ElastiCache for Memcached

Answer

Amazon RDS for MySQL

Question 12

A company is designing a new data lake on AWS. The data lake must support SQL queries using Amazon Athena and also allow Amazon SageMaker to access training data. The solution must minimize storage costs for infrequently accessed data while providing immediate access when needed. Which storage tier should be used for the data lake?

Accepted Answer

Amazon S3 Intelligent-Tiering. Option B is correct because S3 Intelligent-Tiering automatically moves data between access tiers based on usage, minimizing cost for infrequently accessed data while maintaining low latency. Option A (S3 Standard) is more expensive for rarely accessed data. Option C (S3 Glacier) requires restore time. Option D (S3 One Zone-IA) is less durable and not recommended for a data lake.

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon S3 Standard

Answer

Amazon S3 One Zone-Infrequent Access

Question 13

A company is designing a web application that must handle sudden spikes in traffic. The application runs in a VPC and uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The solution must be cost-effective for variable traffic patterns. Which scaling strategy should be used?

Accepted Answer

Target tracking scaling policy based on average CPU utilization. Option D is correct because a target tracking scaling policy with a predefined metric like CPU utilization is the simplest and most cost-effective way to handle variable traffic. Option A (manual scaling) is not dynamic. Option B (scheduled scaling) works for predictable patterns, not sudden spikes. Option C (simple scaling) is less responsive than target tracking.

Answer

Simple scaling with step adjustments

Answer

Scheduled scaling

Answer

Manual scaling

Question 14

A company is designing a serverless application using AWS Lambda. The function needs to process files uploaded to an S3 bucket and store metadata in DynamoDB. The solution must handle up to 1,000 concurrent invocations. Which configuration should be used to avoid throttling?

Accepted Answer

Request a concurrency limit increase from AWS Support. Option A is correct because Lambda functions need to request a concurrency limit increase from AWS Support if the default limit of 1,000 concurrent executions is insufficient. Option B (provisioned concurrency) is for latency-sensitive applications, not for avoiding throttling. Option C (reserved concurrency) limits concurrency. Option D (DLQ) handles failed invocations, not throttling.

Answer

Enable provisioned concurrency

Answer

Use a dead-letter queue (DLQ) to retry throttled requests

Answer

Set reserved concurrency to 1,000

Question 15

A company is designing a new multi-region disaster recovery solution for a critical database. The database runs on Amazon RDS for MySQL in us-east-1. The recovery point objective (RPO) is 1 second, and the recovery time objective (RTO) is 1 minute. Which strategy meets these requirements?

Accepted Answer

Multi-AZ RDS instance with a cross-Region read replica in us-west-2. Option C is correct because Multi-AZ with a cross-Region read replica provides low RPO (via synchronous replication within the region and asynchronous to the replica) and fast failover (RTO ~1 minute). Option A (single-AZ with cross-Region snapshot) has higher RPO/RTO. Option B (Multi-AZ only) does not cover another region. Option D (Aurora Global Database) is for Aurora, not RDS MySQL.

Answer

Single-AZ RDS instance with cross-Region snapshot copy

Answer

Multi-AZ RDS instance in us-east-1

Answer

Amazon Aurora Global Database